warpme has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<marex>
sjg1: actually, it seems like adding a hash node to /configurations does not insert a hash there ?
<sjg1>
marex: No, you cannot hash a configuration
slobodan has quit [Ping timeout: 252 seconds]
dsimic has quit [Ping timeout: 260 seconds]
dsimic has joined #u-boot
<marex>
sjg1: why not ?
<marex>
sjg1: what does signature do in the configuration then ? doesn't it has the node ?
<sjg1>
marex: The configuration is not an image, so hashing it would have no effect. Signing the configuration hashes the nodes that to which it refers (aka the devicetree metadata). Since images have a hash node, this protects the images for change
<marex>
sjg1: but you can (and should) hash the config node too ?
<marex>
sjg1: so ... you can has a configuration ?
<sjg1>
Well, signatures are done by hashing various bits and then signing the hash
<sjg1>
But it makes no sense to add a hash node to a configuration...the hash nodes are for the data properties, and configuration nodes don't have those
<marex>
sjg1: why does it make no sense ? don't the hashes allow u-boot to detect bitrot ?
<sjg1>
Do the slides help?
<marex>
sjg1: no ?
<marex>
sjg1: the question is simple -- why does it make no sense to attach hash to configuration ? won't that prevent bitrot ?
<marex>
s@prevent@allow detection@
<marex>
I need coffee ...
<sjg1>
If someone changes an image, the image hash will detect that. If someone changes the image hash, the configuration signature will detect that
goliath has quit [Quit: SIGSEGV]
slobodan has joined #u-boot
<marex>
sjg1: I am not talking about signed fitImages, I am talking about plain hashed fitImages used during development
urja has quit [Read error: Connection reset by peer]
swiftgeek has quit [Ping timeout: 245 seconds]
<sjg1>
marex: OK, but unfortunately I am lost at this point
<marex>
sjg1: let me ask again then -- why can we not hash configuration node and attach a hash of it to fitImage to detect bitrot in the configuration node ?
<sjg1>
what does 'attach a hash of it to fitimage' mean, in practice?